/mandos/trunk : revision 170

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY COMMANDNAME "mandos-keygen">

6

<!ENTITY TIMESTAMP "2008-08-31">

6

<!ENTITY TIMESTAMP "2008-09-03">

7

]>

8

9

34

<holder>Teddy Hogeborn</holder>

35

<holder>Björn Påhlsson</holder>

36

</copyright>

37

38

<para>

39

This manual page is free software: you can redistribute it

40

and/or modify it under the terms of the GNU General Public

41

License as published by the Free Software Foundation,

42

either version 3 of the License, or (at your option) any

43

later version.

44

</para>

45

46

<para>

47

This manual page is distributed in the hope that it will

48

be useful, but WITHOUT ANY WARRANTY; without even the

49

implied warranty of MERCHANTABILITY or FITNESS FOR A

50

PARTICULAR PURPOSE. See the GNU General Public License

51

for more details.

52

</para>

53

54

<para>

55

You should have received a copy of the GNU General Public

56

License along with this program; If not, see

57

<ulink url="http://www.gnu.org/licenses/"/>.

58

</para>

59

</legalnotice>

37

<xi:include href="legalnotice.xml"/>

60

38

</refentryinfo>

61

39

62

40

67

45

68

46

<refname><command>&COMMANDNAME;</command></refname>

69

47

70

Generate keys for <citerefentry><refentrytitle>password-request

71

</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>

48

Generate key and password for Mandos client and server.

72

49

</refpurpose>

73

50

</refnamediv>

74

51

176

153

</group>

177

154

</cmdsynopsis>

178

155

</refsynopsisdiv>

179

156

180

157

181

158

<title>DESCRIPTION</title>

182

159

<para>

183

160

<command>&COMMANDNAME;</command> is a program to generate the

184

OpenPGP keys used by

161

OpenPGP key used by

185

162

<citerefentry><refentrytitle>password-request</refentrytitle>

186

<manvolnum>8mandos</manvolnum></citerefentry>. The keys are

163

<manvolnum>8mandos</manvolnum></citerefentry>. The key is

187

164

normally written to /etc/mandos for later installation into the

188

initrd image, but this, like most things, can be changed with

189

command line options.

165

initrd image, but this, and most other things, can be changed

166

with command line options.

190

167

</para>

191

168

<para>

192

It can also be used to generate ready-made sections for

169

This program can also be used with the

170

<option>--password</option> option to generate a ready-made

171

section for <filename>clients.conf</filename> (see

193

172

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

194

<manvolnum>5</manvolnum></citerefentry> using the

195

<option>--password</option> option.

173

<manvolnum>5</manvolnum></citerefentry>).

196

174

</para>

197

175

</refsect1>

198

176

199

177

200

178

<title>PURPOSE</title>

201

202

179

<para>

203

180

The purpose of this is to enable <emphasis>remote and unattended

204

181

rebooting</emphasis> of client host computer with an

205

182

<emphasis>encrypted root file system</emphasis>. See <xref

206

183

linkend="overview"/> for details.

207

184

</para>

208

209

185

</refsect1>

210

186

211

187

212

188

<title>OPTIONS</title>

213

189

214

190

215

191

216

192

193

217

194

218

195

<para>

219

196

Show a help message and exit

222

199

</varlistentry>

223

200

224

201

225

<term><literal>-d</literal>, <literal>--dir

226

<replaceable>directory</replaceable></literal></term>

202

<term><option>--dir

203

<replaceable>DIRECTORY</replaceable></option></term>

204

<term><option>-d

205

<replaceable>DIRECTORY</replaceable></option></term>

227

206

228

207

<para>

229

208

Target directory for key files. Default is

233

212

</varlistentry>

234

213

235

214

236

<term><literal>-t</literal>, <literal>--type

237

215

<term><option>--type

216

217

<term><option>-t

218

238

219

239

220

<para>

240

221

Key type. Default is <quote>DSA</quote>.

243

224

</varlistentry>

244

225

245

226

246

<term><literal>-l</literal>, <literal>--length

247

227

<term><option>--length

228

229

<term><option>-l

230

248

231

249

232

<para>

250

233

Key length in bits. Default is 2048.

253

236

</varlistentry>

254

237

255

238

256

<term><literal>-s</literal>, <literal>--subtype

257

239

<term><option>--subtype

240

<replaceable>KEYTYPE</replaceable></option></term>

241

<term><option>-s

242

<replaceable>KEYTYPE</replaceable></option></term>

258

243

259

244

<para>

260

245

Subkey type. Default is <quote>ELG-E</quote> (Elgamal

264

249

</varlistentry>

265

250

266

251

267

<term><literal>-L</literal>, <literal>--sublength

268

252

<term><option>--sublength

253

254

<term><option>-L

255

269

256

270

257

<para>

271

258

Subkey length in bits. Default is 2048.

274

261

</varlistentry>

275

262

276

263

277

<term><literal>-e</literal>, <literal>--email</literal>

278

<replaceable>address</replaceable></term>

264

<term><option>--email

265

<replaceable>ADDRESS</replaceable></option></term>

266

<term><option>-e

267

<replaceable>ADDRESS</replaceable></option></term>

279

268

280

269

<para>

281

270

Email address of key. Default is empty.

284

273

</varlistentry>

285

274

286

275

287

<term><literal>-c</literal>, <literal>--comment</literal>

288

<replaceable>comment</replaceable></term>

276

<term><option>--comment

277

278

<term><option>-c

279

289

280

290

281

<para>

291

282

Comment field for key. The default value is

295

286

</varlistentry>

296

287

297

288

298

<term><literal>-x</literal>, <literal>--expire</literal>

299

289

<term><option>--expire

290

291

<term><option>-x

292

300

293

301

294

<para>

302

295

Key expire time. Default is no expiration. See

307

300

</varlistentry>

308

301

309

302

310

<term><literal>-f</literal>, <literal>--force</literal></term>

303

<term><option>--force</option></term>

304

311

305

312

306

<para>

313

Force overwriting old keys.

307

Force overwriting old key.

314

308

</para>

315

309

</listitem>

316

310

</varlistentry>

317

311

318

<term><literal>-p</literal>, <literal>--password</literal

319

></term>

312

<term><option>--password</option></term>

313

320

314

321

315

<para>

322

316

Prompt for a password and encrypt it with the key already

328

322

>8</manvolnum></citerefentry>. The host name or the name

329

323

specified with the <option>--name</option> option is used

330

324

for the section header. All other options are ignored,

331

and no keys are created.

325

and no key is created.

332

326

</para>

333

327

</listitem>

334

328

</varlistentry>

340

334

<xi:include href="overview.xml"/>

341

335

<para>

342

336

This program is a small utility to generate new OpenPGP keys for

343

new Mandos clients.

337

new Mandos clients, and to generate sections for inclusion in

338

<filename>clients.conf</filename> on the server.

344

339

</para>

345

340

</refsect1>

346

341

347

342

348

343

<title>EXIT STATUS</title>

349

344

<para>

350

The exit status will be 0 if new keys were successfully created,

351

otherwise not.

345

The exit status will be 0 if a new key (or password, if the

346

<option>--password</option> option was used) was successfully

347

created, otherwise not.

352

348

</para>

353

349

</refsect1>

354

350

406

402

</variablelist>

407

403

</refsect1>

408

404

409

410

411

<para>

412

None are known at this time.

413

</para>

414

</refsect1>

405

406

407

408

409

415

410

416

411

417

412

<title>EXAMPLE</title>

425

420

</informalexample>

426

421

427

422

<para>

428

Create keys in another directory and of another type. Force

423

Create key in another directory and of another type. Force

429

424

overwriting old key files:

430

425

</para>

431

426

<para>

435

430

436

431

</para>

437

432

</informalexample>

433

434

<para>

435

Prompt for a password, encrypt it with the key in

436

<filename>/etc/mandos</filename> and output a section suitable

437

for <filename>clients.conf</filename>.

438

</para>

439

<para>

440

<userinput>&COMMANDNAME; --password</userinput>

441

</para>

442

</informalexample>

443

444

<para>

445

Prompt for a password, encrypt it with the key in the

446

<filename>client-key</filename> directory and output a section

447

suitable for <filename>clients.conf</filename>.

448

</para>

449

<para>

450

451

452

<userinput>&COMMANDNAME; --password --dir client-key</userinput>

453

454

</para>

455

</informalexample>

438

456

</refsect1>

439

457

440

458

442

460

<para>

443

461

The <option>--type</option>, <option>--length</option>,

444

462

<option>--subtype</option>, and <option>--sublength</option>

445

options can be used to create keys of insufficient security. If

446

in doubt, leave them to the default values.

463

options can be used to create keys of low security. If in

464

doubt, leave them to the default values.

447

465

</para>

448

466

<para>

449

The key expire time is not guaranteed to be honored by

450

<citerefentry><refentrytitle>mandos</refentrytitle>

467

The key expire time is <emphasis>not</emphasis> guaranteed to be

468

honored by <citerefentry><refentrytitle>mandos</refentrytitle>

451

469

<manvolnum>8</manvolnum></citerefentry>.

452

470

</para>

453

471

</refsect1>

457

475

<para>

458

476

459

477

<manvolnum>1</manvolnum></citerefentry>,

478

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

479

<manvolnum>5</manvolnum></citerefentry>,

460

480

<citerefentry><refentrytitle>mandos</refentrytitle>

461

481

<manvolnum>8</manvolnum></citerefentry>,

462

482

<citerefentry><refentrytitle>password-request</refentrytitle>